Kjell Tore Guttormsen
cae99722a0
Score the guard brief's §7 checklist against the commons-specified architecture: all implemented ingest paths (file/sql) are first-party, so the decisive untrusted-ingest box is currently NO. Record the two designed untrusted boundaries where the guard belongs when built — the http/MCP connector (sanitize + scan-before- persist at ingest materialization) and a received-external OKF bundle (okf.import_bundle) — and explicitly exclude the promotion gate as a first-party path the guard must not wire. Plan only; the guard is not implemented. Add .gitignore keeping STATE.md LOCAL-ONLY (commons is subtree-consumed and open-publish-intended; STATE must never reach a consumer's shared/ or a public mirror). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
8 lines
428 B
Text
8 lines
428 B
Text
# Operational continuity state — LOCAL-ONLY, never committed.
|
|
# Rationale: commons is subtree-consumed (a committed root STATE.md would land in every
|
|
# consumer's shared/STATE.md) and is intended for open publication (STATE must never reach
|
|
# a public mirror). The guard roll-up greps STATE.md locally, so local-only is sufficient.
|
|
/STATE.md
|
|
|
|
# Local-scoped notes/overrides convention (KTG global): never mirrored.
|
|
*.local.md
|